Derive a key/seed from your favorite hardware wallet (BIP85), then derive a series of NOSTR key pairs from that.

Implement an xpub-like intermediary and selected clients could all scan for superseding keys (and validate revocation messages) automatically.